2020-03-25 00:13:36 -05:00
|
|
|
name: Release
|
|
|
|
|
|
|
|
on:
|
|
|
|
push:
|
|
|
|
tags:
|
|
|
|
- 'v*.*.*'
|
|
|
|
|
|
|
|
jobs:
|
|
|
|
release:
|
|
|
|
name: Release
|
|
|
|
strategy:
|
|
|
|
matrix:
|
2023-07-21 23:00:48 -05:00
|
|
|
os:
|
|
|
|
- ubuntu-latest
|
|
|
|
go:
|
2024-08-23 12:01:28 -05:00
|
|
|
- '1.23'
|
2022-04-13 15:03:38 -05:00
|
|
|
|
|
|
|
include:
|
|
|
|
# Set the minimum Go patch version for the given Go minor
|
|
|
|
# Usable via ${{ matrix.GO_SEMVER }}
|
2024-08-23 12:01:28 -05:00
|
|
|
- go: '1.23'
|
|
|
|
GO_SEMVER: '~1.23.0'
|
2022-04-13 15:03:38 -05:00
|
|
|
|
2020-03-25 00:13:36 -05:00
|
|
|
runs-on: ${{ matrix.os }}
|
2022-09-05 15:57:27 -05:00
|
|
|
# https://github.com/sigstore/cosign/issues/1258#issuecomment-1002251233
|
|
|
|
# https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
|
|
|
|
permissions:
|
|
|
|
id-token: write
|
|
|
|
# https://docs.github.com/en/rest/overview/permissions-required-for-github-apps#permission-on-contents
|
2022-09-05 16:35:47 -05:00
|
|
|
# "Releases" is part of `contents`, so it needs the `write`
|
|
|
|
contents: write
|
2020-03-25 00:13:36 -05:00
|
|
|
|
|
|
|
steps:
|
2023-04-14 20:38:33 -05:00
|
|
|
- name: Checkout code
|
2023-10-01 19:13:54 -05:00
|
|
|
uses: actions/checkout@v4
|
2023-04-14 20:38:33 -05:00
|
|
|
with:
|
|
|
|
fetch-depth: 0
|
|
|
|
|
2020-03-25 00:13:36 -05:00
|
|
|
- name: Install Go
|
2024-01-02 02:13:31 -05:00
|
|
|
uses: actions/setup-go@v5
|
2020-03-25 00:13:36 -05:00
|
|
|
with:
|
2022-04-13 15:03:38 -05:00
|
|
|
go-version: ${{ matrix.GO_SEMVER }}
|
|
|
|
check-latest: true
|
2020-03-25 00:13:36 -05:00
|
|
|
|
2020-12-30 16:02:54 -05:00
|
|
|
# Force fetch upstream tags -- because 65 minutes
|
2023-10-01 19:13:54 -05:00
|
|
|
# tl;dr: actions/checkout@v4 runs this line:
|
2020-12-30 16:02:54 -05:00
|
|
|
# git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +ebc278ec98bb24f2852b61fde2a9bf2e3d83818b:refs/tags/
|
|
|
|
# which makes its own local lightweight tag, losing all the annotations in the process. Our earlier script ran:
|
|
|
|
# git fetch --prune --unshallow
|
|
|
|
# which doesn't overwrite that tag because that would be destructive.
|
|
|
|
# Credit to @francislavoie for the investigation.
|
|
|
|
# https://github.com/actions/checkout/issues/290#issuecomment-680260080
|
|
|
|
- name: Force fetch upstream tags
|
|
|
|
run: git fetch --tags --force
|
2020-03-25 00:13:36 -05:00
|
|
|
|
2020-04-26 21:20:14 -05:00
|
|
|
# https://github.community/t5/GitHub-Actions/How-to-get-just-the-tag-name/m-p/32167/highlight/true#M1027
|
2020-03-25 00:13:36 -05:00
|
|
|
- name: Print Go version and environment
|
|
|
|
id: vars
|
|
|
|
run: |
|
|
|
|
printf "Using go at: $(which go)\n"
|
|
|
|
printf "Go version: $(go version)\n"
|
|
|
|
printf "\n\nGo environment:\n\n"
|
|
|
|
go env
|
|
|
|
printf "\n\nSystem environment:\n\n"
|
|
|
|
env
|
2022-12-28 12:05:42 -05:00
|
|
|
echo "version_tag=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
|
|
|
|
echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
|
2020-04-26 21:20:14 -05:00
|
|
|
|
2020-12-30 12:54:58 -05:00
|
|
|
# Add "pip install" CLI tools to PATH
|
|
|
|
echo ~/.local/bin >> $GITHUB_PATH
|
|
|
|
|
2020-06-05 11:23:15 -05:00
|
|
|
# Parse semver
|
|
|
|
TAG=${GITHUB_REF/refs\/tags\//}
|
|
|
|
SEMVER_RE='[^0-9]*\([0-9]*\)[.]\([0-9]*\)[.]\([0-9]*\)\([0-9A-Za-z\.-]*\)'
|
|
|
|
TAG_MAJOR=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\1#"`
|
|
|
|
TAG_MINOR=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\2#"`
|
|
|
|
TAG_PATCH=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\3#"`
|
|
|
|
TAG_SPECIAL=`echo ${TAG#v} | sed -e "s#$SEMVER_RE#\4#"`
|
2022-12-28 12:05:42 -05:00
|
|
|
echo "tag_major=${TAG_MAJOR}" >> $GITHUB_OUTPUT
|
|
|
|
echo "tag_minor=${TAG_MINOR}" >> $GITHUB_OUTPUT
|
|
|
|
echo "tag_patch=${TAG_PATCH}" >> $GITHUB_OUTPUT
|
|
|
|
echo "tag_special=${TAG_SPECIAL}" >> $GITHUB_OUTPUT
|
2020-06-05 11:23:15 -05:00
|
|
|
|
2020-12-30 12:54:58 -05:00
|
|
|
# Cloudsmith CLI tooling for pushing releases
|
|
|
|
# See https://help.cloudsmith.io/docs/cli
|
|
|
|
- name: Install Cloudsmith CLI
|
|
|
|
run: pip install --upgrade cloudsmith-cli
|
|
|
|
|
2020-12-29 14:52:13 -05:00
|
|
|
- name: Validate commits and tag signatures
|
|
|
|
run: |
|
|
|
|
|
|
|
|
# Import Matt Holt's key
|
|
|
|
curl 'https://github.com/mholt.gpg' | gpg --import
|
|
|
|
|
|
|
|
echo "Verifying the tag: ${{ steps.vars.outputs.version_tag }}"
|
|
|
|
# tags are only accepted if signed by Matt's key
|
|
|
|
git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1
|
|
|
|
|
2022-09-02 19:37:10 -05:00
|
|
|
- name: Install Cosign
|
|
|
|
uses: sigstore/cosign-installer@main
|
|
|
|
- name: Cosign version
|
|
|
|
run: cosign version
|
|
|
|
- name: Install Syft
|
|
|
|
uses: anchore/sbom-action/download-syft@main
|
|
|
|
- name: Syft version
|
|
|
|
run: syft version
|
2020-03-25 00:13:36 -05:00
|
|
|
# GoReleaser will take care of publishing those artifacts into the release
|
|
|
|
- name: Run GoReleaser
|
2024-06-06 03:33:19 -05:00
|
|
|
uses: goreleaser/goreleaser-action@v6
|
2020-03-25 00:13:36 -05:00
|
|
|
with:
|
|
|
|
version: latest
|
2023-08-04 11:08:54 -05:00
|
|
|
args: release --clean --timeout 60m
|
2020-03-25 00:13:36 -05:00
|
|
|
env:
|
|
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
2020-04-26 21:20:14 -05:00
|
|
|
TAG: ${{ steps.vars.outputs.version_tag }}
|
2022-09-02 19:37:10 -05:00
|
|
|
COSIGN_EXPERIMENTAL: 1
|
2020-04-26 21:20:14 -05:00
|
|
|
|
2020-06-05 11:23:15 -05:00
|
|
|
# Only publish on non-special tags (e.g. non-beta)
|
2022-04-13 11:13:28 -05:00
|
|
|
# We will continue to push to Gemfury for the foreseeable future, although
|
2020-12-30 12:54:58 -05:00
|
|
|
# Cloudsmith is probably better, to not break things for existing users of Gemfury.
|
|
|
|
# See https://gemfury.com/caddy/deb:caddy
|
2020-04-26 21:20:14 -05:00
|
|
|
- name: Publish .deb to Gemfury
|
2020-06-25 16:58:44 -05:00
|
|
|
if: ${{ steps.vars.outputs.tag_special == '' }}
|
2020-04-26 21:20:14 -05:00
|
|
|
env:
|
|
|
|
GEMFURY_PUSH_TOKEN: ${{ secrets.GEMFURY_PUSH_TOKEN }}
|
|
|
|
run: |
|
|
|
|
for filename in dist/*.deb; do
|
2020-12-30 12:54:58 -05:00
|
|
|
# armv6 and armv7 are both "armhf" so we can skip the duplicate
|
|
|
|
if [[ "$filename" == *"armv6"* ]]; then
|
|
|
|
echo "Skipping $filename"
|
|
|
|
continue
|
|
|
|
fi
|
|
|
|
|
2020-04-26 21:20:14 -05:00
|
|
|
curl -F package=@"$filename" https://${GEMFURY_PUSH_TOKEN}:@push.fury.io/caddy/
|
2020-05-06 15:42:55 -05:00
|
|
|
done
|
|
|
|
|
2020-12-30 12:54:58 -05:00
|
|
|
# Publish only special tags (unstable/beta/rc) to the "testing" repo
|
|
|
|
# See https://cloudsmith.io/~caddy/repos/testing/
|
|
|
|
- name: Publish .deb to Cloudsmith (special tags)
|
|
|
|
if: ${{ steps.vars.outputs.tag_special != '' }}
|
|
|
|
env:
|
|
|
|
CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
|
|
|
|
run: |
|
|
|
|
for filename in dist/*.deb; do
|
|
|
|
# armv6 and armv7 are both "armhf" so we can skip the duplicate
|
|
|
|
if [[ "$filename" == *"armv6"* ]]; then
|
|
|
|
echo "Skipping $filename"
|
|
|
|
continue
|
|
|
|
fi
|
|
|
|
|
|
|
|
echo "Pushing $filename to 'testing'"
|
|
|
|
cloudsmith push deb caddy/testing/any-distro/any-version $filename
|
|
|
|
done
|
|
|
|
|
|
|
|
# Publish stable tags to Cloudsmith to both repos, "stable" and "testing"
|
|
|
|
# See https://cloudsmith.io/~caddy/repos/stable/
|
|
|
|
- name: Publish .deb to Cloudsmith (stable tags)
|
|
|
|
if: ${{ steps.vars.outputs.tag_special == '' }}
|
|
|
|
env:
|
|
|
|
CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}
|
|
|
|
run: |
|
|
|
|
for filename in dist/*.deb; do
|
|
|
|
# armv6 and armv7 are both "armhf" so we can skip the duplicate
|
|
|
|
if [[ "$filename" == *"armv6"* ]]; then
|
|
|
|
echo "Skipping $filename"
|
|
|
|
continue
|
|
|
|
fi
|
|
|
|
|
|
|
|
echo "Pushing $filename to 'stable'"
|
|
|
|
cloudsmith push deb caddy/stable/any-distro/any-version $filename
|
|
|
|
|
|
|
|
echo "Pushing $filename to 'testing'"
|
|
|
|
cloudsmith push deb caddy/testing/any-distro/any-version $filename
|
|
|
|
done
|